Login Request a demo
AV
Product
Avada
by Theme-fusion · last CVE Dec 16, 2025
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 2High 8Medium 9Low 0
Severity
All severities19Critical2High8Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Avada to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-13346
9.8
2%
Feb 13
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13
Affected: before 7.11.14
CVE-2022-1386
9.8
71%
May 16
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests
Affected: before 7.6.2
CVE-2023-39312
8.8
1%
Jun 19
Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1
Affected: before 7.11.2
CVE-2023-39922
8.8
0%
Jun 19
Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1
Affected: before 7.11.2
CVE-2023-39307
8.8
1%
Mar 26
Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1
Affected: before 7.11.2
CVE-2024-1468
8.8
1%
Feb 29
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the…
Affected: before 7.11.5
CVE-2022-41996
8.8
1%
Oct 27
WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability
Affected: through 7.8.1
CVE-2017-18607
8.8
1%
Sep 10
The avada theme before 5.1.5 for WordPress has CSRF
Affected: before 5.1.5
CVE-2023-39313
7.7
1%
Mar 28
Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1
Affected: before 7.11.2
CVE-2024-2344
7.2
1%
Apr 9
The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escaping on the user…
Affected: before 7.11.7
CVE-2024-1668
6.5
1%
Mar 13
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form…
Affected: before 7.11.6
CVE-2024-2343
6.4
1%
Apr 9
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.11.6 via the…
Affected: before 7.11.7
CVE-2017-18606
6.1
1%
Sep 10
The avada theme before 5.1.5 for WordPress has stored XSS
Affected: before 5.1.5
CVE-2024-5628
5.4
0%
Sep 13
The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusion_button shortcode in all versions up…
Affected: before 7.11.9
CVE-2024-2311
5.4
1%
Apr 9
The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.11.6 due to insufficient input…
Affected: before 7.11.7
CVE-2020-36711
5.4
1%
Jun 7
The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up to, and including, 6.2.3 due to insufficient input…
Affected: through 6.2.3
CVE-2025-64634
5.3
0%
Dec 16
WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability
Affected: through 7.13.1
CVE-2024-2340
5.3
28%
Apr 9
The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory
Affected: before 7.11.7
CVE-2024-54357
4.3
0%
Dec 16
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10
Affected: before 7.11.11
Showing 19